topic Re: What attributes can we send from ISE to an external radius authentication servers in Network Access Control

What attributes can we send from ISE to an external radius authentication servers

edmcnich — Thu, 26 Apr 2018 12:40:06 GMT

I have a customer that is integrating ISE with an external radius provider (onelogin) for authentication. This radius instance also provides risk based (adaptive) authentication, where it will challenge based off of client information (Source IP, OS, NAD, etc...). Does ISE forward over any contextual information to the external radius provider during authentication, or is this configurable?

Re: What attributes can we send from ISE to an external radius authentication servers

Craig Hyps — Thu, 26 Apr 2018 21:45:22 GMT

It depends on the RADIUS integration method. The two fundamental methods is RADIUS Token and RADIUS Proxy. With proxy we relay all attributes to external RADIUS instance. ISE can also manipulate attributes in flight to or from external.

In RADIUS Token case, it is a basic RADIUS PAP request with username (identity) where ISE is the NAD (RADIUS client) to external RADIUS server. In response, we accept a single authorization attribute.

Craig

Re: What attributes can we send from ISE to an external radius authentication servers

edmcnich — Thu, 26 Apr 2018 22:17:01 GMT

Thanks Craig

Thanks!